CAPEC-132: Symlink Attack

MITRE CAPEC attack pattern

Description

An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-59

ATT&CK techniques: T1547.009

Prerequisites

• The targeted application must perform the desired activities on a file without checking whether the file is a symbolic link or not. The adversary must be able to predict the name of the file the target application is modifying and be able to create a new symbolic link where that file would appear.

Skills required

• Low: To create symlinks
• High: To identify the files and create the symlinks during the file operation time window

Consequences

• Confidentiality: Other
• Integrity: Modify Data
• Confidentiality: Read Data
• Integrity: Modify Data
• Authorization: Execute Unauthorized Commands
• Accountability, Authentication, Authorization, Non-Repudiation: Gain Privileges

Mitigations

• Design: Check for the existence of files to be created, if in existence verify they are neither symlinks nor hard links before opening them.
• Implementation: Use randomly generated file names for temporary files. Give the files restrictive permissions.

Source

• MITRE CAPEC CAPEC-132